------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888058cc7090 object type: timer_list hint: rose_t0timer_expiry+0x0/0x350 net/rose/rose_link.c:-1
WARNING: CPU: 1 PID: 12831 at lib/debugobjects.c:615 debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 12831 Comm: syz.3.1761 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Code: 4c 89 ff e8 87 9e 8d fd 4d 8b 0f 48 c7 c7 00 45 c0 8b 48 8b 34 24 4c 89 ea 89 e9 4d 89 f0 41 54 e8 0a 11 ec fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 67 56 07 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc90000a08a10 EFLAGS: 00010292
RAX: bf94eb32a9cc0200 RBX: dffffc0000000000 RCX: ffff88807935bc80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa138 R12: ffffffff8a37af80
R13: ffffffff8bc04680 R14: ffff888058cc7090 R15: ffffffff8b6ce100
FS: 00007f8a3ddd56c0(0000) GS:ffff888125e3b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c371f6b CR3: 000000002f5bc000 CR4: 00000000003526f0
Call Trace:
__debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
debug_check_no_obj_freed+0x3a2/0x470 lib/debugobjects.c:1129
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x112/0x440 mm/slub.c:4894
rose_neigh_put include/net/rose.h:166 [inline]
rose_timer_expiry+0x4cb/0x600 net/rose/rose_timer.c:183
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x283/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:751
Code: e8 0b 72 9f 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd d0 ed 9f 8d 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 1c 5c 7e 00 48 c7 c3 d8 7f 8f 92 49 03 1e 48 89
RSP: 0018:ffffc900042cf078 EFLAGS: 00000246
RAX: 1ffffffff1b3fdbb RBX: 0000000000000001 RCX: bf94eb32a9cc0200
RDX: 0000000000000000 RSI: ffffffff8bc03b40 RDI: ffffffff8bc03b00
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffffff8172ad05
R10: ffffc900042cf1b8 R11: ffffffff81ab4450 R12: 1ffff92000859e2d
R13: ffffc900042cf1a0 R14: ffffffff8d9fedd8 R15: dffffc0000000000
rcu_read_lock include/linux/rcupdate.h:842 [inline]
class_rcu_constructor include/linux/rcupdate.h:1169 [inline]
unwind_next_frame+0xd4/0x2390 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
ref_tracker_alloc+0x133/0x460 lib/ref_tracker.c:271
__netdev_tracker_alloc include/linux/netdevice.h:4375 [inline]
netdev_hold include/linux/netdevice.h:4404 [inline]
ipv6_add_dev+0x52f/0x1370 net/ipv6/addrconf.c:411
addrconf_notify+0x794/0x1010 net/ipv6/addrconf.c:3650
notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
register_netdevice+0x1608/0x1ae0 net/core/dev.c:11332
__ip_tunnel_create+0x3e7/0x560 net/ipv4/ip_tunnel.c:268
ip_tunnel_init_net+0x2ba/0x800 net/ipv4/ip_tunnel.c:1161
ops_init+0x359/0x5c0 net/core/net_namespace.c:137
setup_net+0xfe/0x320 net/core/net_namespace.c:445
copy_net_ns+0x34e/0x4e0 net/core/net_namespace.c:580
create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:218
ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3132
__do_sys_unshare kernel/fork.c:3203 [inline]
__se_sys_unshare kernel/fork.c:3201 [inline]
__x64_sys_unshare+0x38/0x50 kernel/fork.c:3201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8a3fb8eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8a3ddd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8a3fde6090 RCX: 00007f8a3fb8eec9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200
RBP: 00007f8a3fc11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8a3fde6128 R14: 00007f8a3fde6090 R15: 00007ffff3b6e6f8
----------------
Code disassembly (best guess):
0: e8 0b 72 9f 09 call 0x99f7210
5: 89 c3 mov %eax,%ebx
7: 83 f8 08 cmp $0x8,%eax
a: 73 65 jae 0x71
c: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
13: fc ff df
16: 4c 8d 34 dd d0 ed 9f lea -0x72601230(,%rbx,8),%r14
1d: 8d
1e: 4c 89 f0 mov %r14,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 f7 mov %r14,%rdi
2f: e8 1c 5c 7e 00 call 0x7e5c50
34: 48 c7 c3 d8 7f 8f 92 mov $0xffffffff928f7fd8,%rbx
3b: 49 03 1e add (%r14),%rbx
3e: 48 rex.W
3f: 89 .byte 0x89